So to clarify... just so I get it right, that means that for what I am trying to do I should write it 10.10.10.(3[2-9]|[4-5][0-9]|6[0-1])$ Sorry I keep asking for clarification. ... View more

Okay, I didn't realize it was to be in a regex format. Can you clarify the expression where you use \d{1,3}. Looks like to me it would be the network ip (i.e. 10.10.10.\d) but what is the {1,3}? Thanks, ... View more

Can you attach a screenshot of what you are of the dashboard? Try going to Search and Reporting, then clicking on data summary to see if your devices are sending syslog data. If you see the device IP address or hostname, click on it and then see what kind of source or sourcetype information you are getting. You should see udp:514 or whatever port you have configured for your network devices to send syslogs to. ... View more

I don't know if your question has been answered, but I think it would help if we know what versions of Splunk App for Windows Infrastructure are you running and which Splunk Add-On for windows? ... View more

This has gone beyond what I had expected. Working with Doug Hurd and Cisco TAC, it has been determined that the app looks for the Python version that is installed on your Linux install and not what Splunk has installed. So I am running RHEL 6.9 which has Python version 2.6.6 and even with Splunk installed with Python version 2.7, it generates an error because the app or specifically the script splencore.sh is referencing the OS version of Python. I checked the Cisco script for CLI (encore.sh) and it specifically references the OS version. So to me, I see the app referencing the wrong place and somehow the version check needs to be redirected to the Splunk version. I hope that I was able to explain this properly so that it can be understood. If you have questions, don't hesitate to ask. Thank you. ... View more

The more I dig, it seems that eStreamer (slencore.sh) is assuming that the server is running Python 2.7 in its OS, rather than picking it up from Splunk. When I have looked at the encore.sh script, in the init section, it actually goes out and looks for Python 2.7 'pythonVersion='pybin -V 2>&1 | grep "Python 2.7"'. However, that may not actually get it to use Python 2.7 located in /opt/splunk/bin. Is there a way to change the variable pybin="python" to the actual location of Splunk's python, then it might work. ... View more

lakshman After all that, I decided to change the relative path "$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore" to the explicit path "/opt/splunk/etc/apps/TA-eStreamer/bin/encore" and I was able to run the test even through it failed. Unfortunately, it started with this message: "This software is currently only compatible with Pyhon 2.7. You are running 2.6.6. I have Splunk running on RHEL 6.9 It started the diagnostic portion anyway, and when it wanted the password for the client.pkcs12, there was this message: /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/crossprocesslogging/baseClient.py:35: DeprecationWarning: BaseExceptionmessage has been deprecated as of Python 2.6. Any ideas? ... View more

lakshman, I tried what you posted. This is what it now looks like basepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore" datafilepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/data" isRunning=0 I modified the clean statement so that it looks like what you have. I still ended up with the same error... "/etc/apps/TA-eStreamer/bin/encore "doesn't exist" I had updated to TA-eStreamer 3.5.4 hoping that the problem would clear, but it doesn't. Today, I will try to update Splunk to 7.2.1 hoping for better results, but not holding my breath. Let me know if I did anything wrong. I can provide the splencore.sh file if you would like to see it. Thanks for the help. ... View more

I have returned to working on this issue. I am now running Splunk 7.2.0 and FMC 6.3. I uninstalled eStreamer eNcore and reinstalled. I used 3.5.3. I still have the same issue when trying to get eNcore to work. I did notice when I was using the CLI something different that may be a reason why this is failing. When I ran ./splencore.sh test, the error "/etc/apps/TA-eStreamer/bin/encore "doesn't exist". I can see the directory. I opened up the file and found that line 12 establishes the variable for basepath="$SPLUNk_HOME/et/apps/TA-eStreamer/bin/encore". This is lines 25-32 init() { # change pwd if [ -d $basepath ] then cd $basepath else echo "\"$basepath\" does not exist" exit $EXIT_CODE_ERROR The above if/else statements are also found in the configure.sh script. Anyone have any ideas how to correct this? Thank you. ... View more

update: I am now running Splunk 7.2.0. ... View more

Finally got back to working on this. I am still having issues with it processing the pcks12 file, but I fixed the argparse file issue. Here is what I did: 1) copied a full iso of RHEL6.9 on the Splunk Server 2) mounted it into a directory /mnt/iso 3) from the Packages directory ran yum install pyton-argparse-.rpm Once I did that I could run the splencore.sh script. Unfortunately, it still fails to process the pkcs12 file. ... View more

Sam, I know this is many months since I worked on this. I have progressed to the point, where I can run splencore.sh test but it fails to process the pkcs12 file. It goes fine until it has to process the client.pkcs12 file and when I put the password in, it returns the error EndoreException: Unable to process pkcs12 file. Possibly a password problem That's all well and fine, but I did not put a password on this client.pkcs file. Is there something I missed along the way? ... View more

Finally got back to working on this. I am still having issues with it processing the pcks12 file, but I fixed the argparse file issue. Here is what I did: 1) copied a full iso of RHEL6.9 on the Splunk Server 2) mounted it into a directory /mnt/iso 3) from the Packages directory ran yum install pyton-argpase- ... View more

Sure did try that. I tried so many times, I had certs that were named with extensions like 12.pkcs12. Everything gets so messed up when I work on this, I remove the app and the add-on as I said, like a clean start. I use this time to get away from the frustration and catch up on some other work. I will probably try again tomorrow or late this afternoon. I just don't know which IP address scheme I should use. To have everything on the data network or to leave it on the management network. ... View more

Thanks for following up. I tried to recreate the FMC certificate with and without a password. I even went so far as to change the IP addresses of the FMC, SFRs and their gateways from the management network to a free space on the data network with the same problems. So usually at this point so that I can do my work, I remove eStreamer eNcore and return Splunk to the previous state to clean up and start fresh. If you have any other ideas, it would be greatly appreciated. ... View more

No still working on it. I removed the app from Splunk and will re-install. I have another post Splunk eStreamer eNcore client doesn't start at this link https://answers.splunk.com/answers/667021/splunk-estreamer-encore-client-doesnt-start.html#comment-667366. I am working with a Sam Strathan who wrote some of the python scripts that this app runs. He suggested I try to manually split the keys (public and private) out of the certificate. I am not sure if I'll get to it today, but I will certainly give it a try. ... View more

I'll give it a try. I removed the app from the Splunk server just to clean it up. I also made some modifications so that I could put FMC and the firepower service modules on the ASAs into their own subnet that I hope will work to have proper communications between them and Splunk too. Thanks, ... View more

Sam, I was looking at the preflight.py file because of what I am encountering in this post: eStreamer for Splunk error outputting keys and certificates. Do you have any idea why it fails when I try to start splencore.sh manually from the CLI at line 32 "import.argparse" Thank you ... View more

Verified the pre-requisites... python is located /opt/splunk/bin/python2.7 OpenSSL is located in /opt/splunk/bin/openssl If Python is install, then I should have the argparse module installed too! At this point, I don't know if I should go to Cisco support or Splunk support. ... View more

rsanders30, I am running Splunk in a Linux (RHEL) environment. I did follow the eStreamer eNcore Operations Guide v3.0. and in the section Pre-requisites, it states that if: 1) running the Cisco eSreamer eNcore for Splunk 2) provided that the default installation of Splunk which includes Python 2.7 and OpenSSL. then no further action is required. Now that I look at it again, I am beginning to wonder a few things that I need to look at. I'll post back after I verify like I am doing the CLI install of this app. ... View more

Thanks for the input. I did everything that you had listed before even posting and did many times where I even removed the app and started over clean. If I run the searches, that you listed under execution, for status I get stopped, for log I get what I posted in the encore.log output and for data, I get nothing because the service splencore is not running. I am trying to determine why it doesn't start and it seems that there is something wrong with the starting of the service. See my other post: ImportError: No module named arparse. I think once I get that fixed it may actually work. Thanks again sam_strachan ... View more

rsanders30 Thanks for that update. The change that you posted to edit the splencore.sh file got it so where I could run ./splencore.sh test and start. The problem now is that it fails: Traceback (most recent call last): File "./estreamer/preflight.py", line 32 in import argparse ImportError: No module named arparse I am no scholar when it comes to Linux and Python, so it leaves me confused. If you can provide some direction, I would greatly appreciate it. I used the http://www.thesecurityblogger.com/configuring-cisco-firepower-estreamer-with-splunk-7/ as my guide to configure this. I also have some other problems too, but I need to take it one by one. ... View more